Description

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T22:16:47.090Z",
  "pubdate": "2026-08-06T22:16:47.090Z",
  "executiveSummary": "An input validation vulnerability exists in the Easy Booking WordPress plugin before version 3.5.0, specifically concerning the enforcement of bookable product configurations. The vulnerability arises from a lack of server-side validation when processing booking durations during the cart addition and price calculation phases. Unauthenticated attackers can exploit this flaw to bypass business logic constraints, successfully placing bookings that violate configured minimum duration rules and completing underpriced transactions. The risk implication centers on financial loss and resource manipulation for merchants utilizing the affected software. Exploitation requires network access to the target WordPress installation and can be performed remotely by any unauthenticated user without requiring prior privileges or complex interaction.",
  "technicalDetails": "The root cause of the vulnerability is the absence of robust server-side enforcement for minimum booking duration parameters within the Easy Booking WordPress plugin prior to version 3.5.0. While client-side interfaces typically restrict users from selecting booking durations below the configured minimum, the underlying backend logic fails to re-validate these constraints when requests are made to add items to the shopping cart and calculate final pricing.\nThe attack flow proceeds as follows: an unauthenticated attacker interacts with a bookable product page managed by the vulnerable Easy Booking plugin. Instead of relying solely on the legitimate browser-based interface, the attacker crafts a malicious HTTP request directed at the cart addition and price calculation endpoints. By manipulating parameters associated with the booking duration to a value lower than the enforced minimum, the attacker bypasses the intended client-side restrictions.\nBecause the server component fails to perform authoritative bounds checking against the product's configured minimum booking duration, the backend processes the manipulated duration value as legitimate. Consequently, the calculation engine computes the total cost based on the unauthorized sub-minimum duration, resulting in an artificially reduced price. The manipulated product and pricing data are then successfully committed to the cart session, allowing the unauthenticated user to proceed through the checkout workflow and complete an underpriced order.\nThe vulnerable component resides within the booking validation and pricing calculation logic of the Easy Booking plugin. Affected versions include all releases prior to 3.5.0. The attack vector is strictly network-based, exposing the application via standard HTTP/HTTPS protocols. No authentication, special privileges, or prior access are required to execute this payload behavior, making it accessible to any external threat actor interacting with the vulnerable WordPress site. The post-exploitation impact is characterized by unauthorized financial transactions, distorted inventory utilization, and potential economic harm to the merchant."
}